Privacy notice
GIM - Genetic Institute Munich
Information under Articles 13 and 14 GDPR
Text version: 12 October 2026
1 Controller and scope
Melinda Bartók, sole trader operating under GIM - Genetic Institute Munich.
Georg-Knorr-Straße 21, 85662 Hohenbrunn, Germany.
Email for privacy questions and requests: info@geneticinstitute.eu.
This notice covers use of the GIM website, enquiries, partner applications and the GIM ordering process. Laboratory analysis, genetic data and sample processing, and the results portal are covered by supplementary information. An external provider’s notice does not replace information about GIM’s own processing.
2 Sources of data and grounds for processing
We primarily process information you provide in forms, when ordering or in messages. Technical data arise when you use the website. We may receive payment and transaction status from the payment provider, delivery information from the shipping partner, and status information needed for order handling from the laboratory partner. An organisation or its representative may also provide the details of a contact person.
We process ordinary order data to take pre-contractual steps and perform contracts under Article 6(1)(b) GDPR. Article 6(1)(c) applies to legal obligations, (f) to legitimate interests and (a) to consent. The specific purposes are explained below.
For genetic or health-related data, relying on a contract or legitimate interests alone is insufficient: a condition under Article 9 GDPR must also be met. We obtain explicit, purpose-specific consent for special categories of data needed for the personalisation you order.
3 Enquiries and partner applications
We use the name, contact details, selected subject, message and necessary related information you provide to deal with your enquiry. Partner applications also involve organisation, contact person and professional field details.
For questions about your own contract or pre-contractual steps you request, the legal basis is Article 6(1)(b) GDPR. For other enquiries and organisational contacts, our legitimate interest is appropriate enquiry handling and business communication under Article 6(1)(f) GDPR.
We use the Pipedrive CRM system for partner applications. The general contact form is handled separately. Minimal status data needed for order administration may also be processed in Pipedrive. Contacting us does not subscribe you to a newsletter or constitute general marketing consent.
Please do not send full genetic reports, medical findings or detailed health information in your first enquiry. If such information is needed, we will agree on an appropriate transfer method and the purpose-specific legal basis.
Partner enquiry forms are provided through Pipedrive. GIM uses the information to establish and manage the partnership. Pipedrive processes customer data on GIM's behalf and instructions. Loading the form establishes a technical connection to the provider; an IP address and browser information may also be transmitted. Section 9 applies to retention of enquiries.
Pipedrive privacy information: https://www.pipedrive.com/en/privacy
Data processing terms: https://www.pipedrive.com/en/privacy/dpa
The website's contact form and partner enquiry form are both provided through Pipedrive Web Forms as two separate forms; enquiries sent via the contact form are also received in GIM's Pipedrive account. The form loads from Pipedrive's servers when you open the contact or partner page, without a separate click. The data you enter is recorded directly by Pipedrive; the website's WordPress system does not keep a copy.
4 Orders and personalisation
When you order, we process your name, date of birth, required basic personalisation details, contact details, billing and delivery details, report language, selected package, and order, payment and fulfilment identifiers and statuses. Once you receive the sampling kit, the test code is linked to your order.
Ordinary contract administration is based on Article 6(1)(b) GDPR. Personalisation uses the height, weight, target weight, exercise frequency, smoking and dietary habits entered in the form. Where these constitute genetic or health-related special categories of data, processing relies on explicit consent under Article 6(1)(a) and Article 9(2)(a) GDPR.
We use the data to deliver the analysis, results report and, if selected, personalised product you ordered. Without information marked as required, the order or relevant service cannot be fulfilled. Omitting optional information does not prevent basic website use. Marketing consent is not a condition of ordering.
To evidence consent and contractual declarations, we retain their text, version, time and link to the order. Evidence of consent serves Article 7(1) GDPR and accountability, on the basis of Article 6(1)(c) GDPR. Only necessary data are retained for legal claims on an applicable legal basis.
5 Payments invoicing and delivery
We use Stripe for payments and Lexware for invoicing. Providers receive the order, contact, billing and transaction information needed for their tasks. GIM does not store full payment card details. The delivery provider receives the name, delivery address and necessary delivery contact details.
Payment and delivery rely on Article 6(1)(b) GDPR; mandatory accounting records rely on Article 6(1)(c). The payment provider may also process data for its own legal obligations and fraud prevention purposes, about which it provides its own information. Laboratory results are not data needed for invoicing or delivery.
Stripe privacy information: https://stripe.com/privacy
Lexware privacy information: https://datenschutz.lexware.de/
6 Access by staff and service providers
Only people with appropriate, task-specific authorisation can access personal data at GIM. We use hosting, IT, email, CRM, payment and invoicing providers, as well as delivery and laboratory partners. Google Workspace supports email communication. Where a provider acts as a processor, an agreement under Article 28 GDPR governs its work.
Tax advisers, legal representatives, courts or authorities receive data only where justified and necessary. The basis may be a legal obligation under Article 6(1)(c) GDPR or a legitimate interest in handling legal claims under Article 6(1)(f). Article 9(2)(f) GDPR may apply to special categories of data needed for such claims. We do not sell personal data.
GIM uses Google Workspace for its business email to receive and respond to enquiries, order messages and business correspondence. Sender and recipient details, messages, attachments and technical delivery information may be processed. The purpose and legal basis depend on the enquiry or order as described in Sections 3-5; Section 9 governs retention.
Google Workspace data processing terms: https://workspace.google.com/terms/dpa_terms.html
7 Genetic laboratory analysis and results portal
Our laboratory partner is Novogenia GmbH, Strass 19, 5301 Eugendorf, Austria. We transfer the identification, contact, order, test code and personalisation data required for the ordered test to the laboratory. The sample must be sent to the specified laboratory address. Novogenia performs the analysis, manages laboratory results and provides protected personal access to results.
GIM handles order administration, payments, invoicing, test code assignment and customer communication. We do not store raw genetic data or the full results report in GIM’s webshop database. A sample or information labelled with a test code is not anonymous if it can be linked back to a person.
Explicit consent to genetic data processing concerns the specified test and personalisation. It does not automatically cover research, advertising or disclosure to other doctors. Supplementary information describes sample handling and laboratory and portal processing.
You can withdraw consent for the future at info@geneticinstitute.eu. GIM takes action within its own responsibility and coordinates with the laboratory partner where necessary. Withdrawal does not affect the lawfulness of earlier processing or undo a test already performed. Further processing requires a separately applicable legal basis and must be limited to what is necessary. Withdrawal of consent is distinct from exercising the right to withdraw from a contract.
General privacy information for the Novogenia website: https://www.novogenia.com/privacy.html
This link leads to Novogenia Marketing GmbH's website privacy notice. It provides supplementary information and does not replace the specific privacy information and consents for the laboratory test, sample processing and results account concerned.
8 Questions about results and contact with doctors
If you request help understanding a result, we first establish your question and the data needed to answer it. We process individual result details only as necessary and on an appropriate legal basis; for special categories of data, we generally seek specific explicit consent. Sending a full report does not itself replace the necessary information and legal basis.
Asking about contact with a doctor does not automatically trigger data disclosure. If you request an introduction, we identify the recipient and the data to be shared beforehand. Sharing health or genetic data requires a separate, purpose-specific legal basis. The medical provider supplies its own privacy information.
9 Retention and deletion
We retain data for as long as needed for the stated purpose. General enquiries that do not lead to a contract are normally retained for no more than twelve months after the matter closes; if the reason ceases earlier, we delete earlier. Partner contracts, orders, complaints and legal claims are subject to the retention rules for the respective matter.
Under German tax law, accounting vouchers subject to mandatory retention are generally retained for eight years, business correspondence for six years, and books and financial statements in the ten-year category for ten years. The period begins at the end of the relevant calendar year under the applicable rules; ongoing proceedings may require longer retention.
Lifestyle data, samples and genetic results do not automatically follow invoice retention periods. GIM processes lifestyle data for the personalisation ordered and necessary follow-up administration. Further retention for a new purpose requires separate information and an appropriate legal basis. Laboratory information describes retention of laboratory data and samples.
We retain evidence needed for legal claims with regard to applicable limitation periods and, where relevant, the conclusion of proceedings. During mandatory retention, we restrict use for other purposes.
10 Website hosting and IT security
The website is hosted by Websupport Magyarország Kft., Fehérvári út 97-99., 1119 Budapest, Hungary. The hosting provider processes technical data required to operate the website as part of its hosting services. Privacy information: https://www.websupport.hu/adatvedelem/
The website is based on WordPress and also uses Elementor elements. When you access it, technical data such as your IP address, time, requested page or file, browser and device details, referring page, and transfer and error information may be processed. This enables content delivery, availability and troubleshooting. The basis is our legitimate interest in secure website operation under Article 6(1)(f) GDPR.
We restrict access by task and authorisation and apply technical and organisational measures appropriate to the risk. HTTPS/TLS protects transmission but does not guarantee protection against every security risk. Please send particularly sensitive information only through an appropriate channel agreed in advance.
The hosting provider keeps server logs of requests. They record the requested domain, IP address, time of the request, requested page or file, status code and amount of data transferred, referring page, browser identifier (user agent) and technical delivery details; an error log is also kept when errors occur. The hosting provider keeps the log files in daily files and currently deletes them after about two weeks.
The website's administration area is protected by the WordPress plugin Kadence Security (SolidWP). After repeated failed login attempts, it temporarily blocks the IP address concerned; security events are logged with the IP address in the website database and deleted after 60 days. The plugin does not transmit visitor data to external logging services. The email plugin keeps a delivery log of system emails sent by the website (such as administrative notifications), which we retain for 14 days.
11 Cookies external content and protection against automated submissions
Storing information on your device or accessing information already stored there requires prior consent unless an exception under Section 25(2) of the German TDDDG applies, such as a function strictly necessary for a service you expressly request. Subsequent personal data processing requires a separate GDPR legal basis appropriate to its purpose.
Non-essential analytics and marketing technologies rely on prior consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can refuse consent and change or withdraw it for the future through the website’s privacy or cookie settings. Necessary evidence of consent is processed for accountability.
Form protection is intended to prevent unwanted and automated submissions. Necessary and proportionate personal data processing may rely on the legitimate interest in security under Article 6(1)(f) GDPR. This does not automatically exempt device access from consent requirements.
Google Analytics - usage statistics. We use Google Analytics to analyse visitor numbers, website use and the performance of our content, only with your consent to statistics technologies. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may include device and browser information, online identifiers, pages viewed, usage events, timestamps and approximate location. The IP address may be processed technically; this does not mean complete anonymity. Section 13 also applies to transfers to Google.
Google privacy information: https://policies.google.com/privacy
Meta Pixel - advertising effectiveness. We use Meta Pixel to measure advertising effectiveness and create interest-based advertising audiences, only with your marketing consent. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The technology may transmit page views, usage events, online identifiers, and browser and device information. Meta may link these to its user accounts. For collection and transmission associated with the Pixel, GIM and Meta may act as joint controllers within the scope of Meta's terms; Meta is responsible for its subsequent processing for its own purposes.
Meta privacy information: https://www.facebook.com/privacy/policy/
Joint controller terms: https://www.facebook.com/legal/controller_addendum
We do not transmit form messages, genetic reports, health data or test codes to analytics or marketing services. Such information must not appear in tracking events or page addresses either. Refusing consent does not prevent you from ordering or contacting us.
Protection against automated submissions and external content. The contact form and the partner enquiry form use Pipedrive's built-in protection, which is based on Google reCAPTCHA (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). reCAPTCHA loads together with the form from Google's servers and may process technical data to detect automated submissions, such as IP address, browser and device information and information about interactions on the page; for this purpose, information may also be stored on or read from your device. To prevent abuse, Pipedrive sets a technical cookie (__cf_bm) that expires after 30 minutes on the pipedrive.com domain. Google's privacy information is linked above.
The website's fonts, images and videos are loaded from our own web space; we do not use external font, video or map services. WhatsApp and social media links only open the external service when you click them.
12 WhatsApp and social networks
Following the WhatsApp link takes you to an external service. GIM uses your message, phone number, profile information you share and necessary communication data to answer your enquiry on the basis explained in Section 3. WhatsApp’s own processing is governed by its own terms.
Using WhatsApp is optional; you can also reach us by email or through the contact form. WhatsApp is for order, organisational and technical questions. Please do not send genetic reports or medical findings through it.
Links to Facebook, Instagram, TikTok and LinkedIn lead to external sites. Opening them also involves the platform’s own processing. A simple link and embedded tracking code are different technical arrangements; tracking requiring consent needs separate consent.
WhatsApp privacy information for EEA users: https://www.whatsapp.com/legal/privacy-policy-eea
13 International transfers
International providers may process data or access it outside the EEA. The requirements of Chapter V GDPR must also be met: an applicable adequacy decision or appropriate safeguards, such as EU standard contractual clauses and supplementary measures where necessary, are required. Article 49 GDPR derogations do not automatically replace appropriate safeguards for regular transfers.
You may request information and copies concerning applicable safeguards at info@geneticinstitute.eu; protected information relating to others will be preserved.
Google Workspace, Pipedrive, Stripe and, with consent, Google Analytics and Meta use international provider networks; processing or access may also take place in the United States. General provider terms may provide for EU standard contractual clauses or, where applicable, an adequacy decision. Only a safeguard actually applicable to the recipient and service concerned can be relied on for a particular transfer. The provider documents linked in Sections 3, 5, 6, 11 and 12 provide further information. Transfers to Google outside the EEA may also occur when the Google reCAPTCHA embedded in the Pipedrive forms is used.
14 Your data protection rights
Subject to the GDPR’s conditions, you may exercise the following rights at info@geneticinstitute.eu.
Access and a copy (Article 15): you may ask whether we process your data, which data, for what purposes, from which sources, for how long, and to which recipients it is disclosed. You may obtain a copy of your personal data, taking account of others’ rights.
Rectification (Article 16): you may request correction of inaccurate information and completion of incomplete information.
Erasure (Article 17): you may request deletion, for example where the purpose has ceased, no further legal basis exists or processing was unlawful. Statutory retention duties and other applicable exceptions may limit this right.
Restriction (Article 18): you may request restricted use under the legal conditions, for example while disputed accuracy is checked.
Portability (Article 20): for automated processing based on consent or a contract, you may request data you provided in a structured, commonly used, machine-readable format and, where technically feasible, its direct transfer to another controller.
Objection (Article 21): you may object to processing based on legitimate interests for reasons relating to your particular situation. We will stop processing unless we demonstrate overriding compelling legitimate grounds or processing is needed for legal claims. You may object to direct marketing at any time, including associated profiling; we will then stop using your data for that purpose.
Withdrawal of consent (Article 7): you may withdraw consent at any time for the future. Earlier processing remains lawful if it was lawful before withdrawal.
Handling requests: we normally inform you of action taken within one month. For complex or numerous requests, this may be extended by two further months; we notify you of the extension and reasons within one month. We request only necessary and proportionate information to verify identity. Requests are generally handled free of charge, subject to GDPR exceptions.
15 Complaints to a supervisory authority
You may complain to a data protection authority, particularly in the Member State of your habitual residence, workplace or the alleged infringement. The authority responsible for GIM’s place of establishment is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
https://www.lda.bayern.de/de/kontakt.html
16 Automated assessment and updates
The GIM ordering process does not make solely automated decisions producing legal or similarly significant effects on you. Genetic analysis and personalisation may involve computer-assisted assessment; this alone is not a decision within Article 22 GDPR. Supplementary information explains the laboratory process.
We update this notice when services or processing change. An amendment does not itself provide consent for new processing purposes. Where necessary, we notify you separately and obtain new consent.